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Foreword 

This Technical Specification (TS) has been produced by the ETSI 3 ld Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under www.etsi.org/key . 
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Foreword 



id , 



This Technical Specification has been produced by the 3 r Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document contains the coding of information necessary for support of location service operation on the 
SMLC-BSS interface layer 3. 

Clause 2 gives the functional definitions and contents of messages for location service operations. Clause 3 gives the 
general format and coding for messages used for location service and the format and coding of information elements 
used for location service operations. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. 

[1] 3GPP TS 01.04: "Digital cellular telecommunications system (Phase 2+); Abbreviations and 

acronyms". 

[2] 3GPP TS 03.71: "Digital cellular telecommunications system (Phase 2+); Location Services 

(LCS); (Functional description) - Stage 2". 

[3] 3GPP TS 04.07: "Digital cellular telecommunications system (Phase 2+); Mobile radio interface 

signalling layer 3; General aspects". 

[4] 3GPP TS 04.08: "Digital cellular telecommunications system (Phase 2+); Mobile radio interface 

layer 3 specification". 

[5] 3GPP TS 05.08: "Digital cellular telecommunications system (Phase 2+); Radio subsystem link 

control". 

[6] 3GPP TS 08.08: "Digital cellular telecommunications system (Phase 2+); Mobile-services 

Switching Centre - Base Station System (MSC-BSS) interface; Layer 3 specification". 

[7] 3GPPTS 09.31. 

1 .2 Abbreviations 

Abbreviations used in the present document are listed in 3GPP TS 01.04. 
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2 Messages functional definitions and contents 

2.1 General 

This subclause defines the structure of the messages of the SMLC-BSS layer 3 protocol defined in 3GPP TS 03.71. 
Each definition includes: 

a) a brief description of the message; 

b) a table listing the information elements in the order of their appearance in the message. 
For each IE the table indicates: 

1) the name of the IE (which gives an idea of the semantics of the element), which is used in this and other 
specifications as a reference to the IE within the message; 

2) the name of the type of the IE (which indicates the coding of the value part of the IE), and a reference to a 
description of the value part of the IE; 

3) the presence requirement indication (M, C or O) for the IE, as defined in 3GPP TS 04.07; 

4) the format of the IE (T, V, TV, LV, TLV) as defined in 3GPP TS 04.07; 

5) the length of the IE (or permissible range of lengths), in octets, in the message. The value of the length gives 
the number of octets in the IE following the length and element identifier. Where the length is encoded using 
more than one octet, the high order bit is bit 8 of the first (lowest numbered octet) and the low order bit is bit 
1 of the last (highest numbered octet). 

c) subclauses specifying conditions for IEs with presence requirement C or O in the relevant message. Together 
with other conditions specified in 3GPP TS 03.71 this defines when the IE shall be included or not, what non- 
presence of such IEs means, and (for IEs with presence requirement C) the static conditions for presence and/or 
non-presence of the IEs (see 3GPP TS 03.71). 



2.2 Messages 



The following Location Services related messages are exchanged between the SMLC and the BSS, with the VMSC 
acting as a relay. 

1. TA Request 

2. TA Response 

3. TOA Request 

4. TOA Response 

5. Reject 

6. Reset 

7. Abort 

8. TALayer3 

9. MS Position Command 

10. MS Position Response 
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On the A interface the messages are contained in the Location Information IE which is encapsulated in the BSSMAP- 
LE Connection Oriented Information message as specified in 3GPP TS 08.08. On the Ls interface the messages are 
contained in the Location Information IE which is encapsulated in the BSSMAP-LE Connection Oriented Information 
message as specified in 3GPP TS 09.31. 

2.2.1 TA Request 

The TA Request is a message from the SMLC to the BSS, requesting BSS to return the timing advance (or access 
delay) of the MS. 

Table 2.1 : TA Request message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 



2.2.2 TA Response 

The TA Response is a message from the BSS to the SMLC. It is a response to TA Request message and contains the 
following information elements. 

Table 2.2: TA Response message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Serving Cell Identity 


Cell Identity IE 3.4 


M 


TV 


3 


Timing Advance 


Timing Advance IE 3.2 


M 


TV 


2 


Measurement Report 


Measurement Report IE 3.12 


O 


TLV 


18 



2.2.3 TOA Request 

The TOA Request is a message from the SMLC to the BSS. It contains the following information elements. 

Table 2.3: TOA Request message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Delta Timer 


Delta Timer IE 3.1 3 


M 


TV 


2 


Handover Type 


Handover Type IE 3.3 


M 


TV 


2 


Serving Cell Identity 


Cell Identity IE 3.4 


M 


TV 


3 


Serving Starting Time 


Starting Time IE 3.5 


M 


TV 


3 


Neighbor Cell Identity 


Neighbor Cell Identity IE 3.6 


O 


TLV 


4-n 


Neighbor Starting Time 


Neighbor Starting Time IE 3.7 


O 


TLV 


4-n 



2.2.4 TOA Response 

The TOA Response is a message from the BSS to the SMLC. It is a response to the TOA Request message. It contains 
the following information elements. 
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Table 2.4: TOA Response message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Channel Description 


Channel Description IE 3.8 


M 


TV 


4 


Frequency List 


Frequency List IE 3.9 


M 


TLV 


3-n 


Handover Reference 


Handover Reference IE 3.10 


M 


TV 


2 


Target Cell Identity 


Cell Identity IE 3.4 


M 


TV 


3 


Serving Cell Identity 


Cell Identity IE 3.4 


M 


TV 


3 


Timing Advance 


Timing Advance IE 3.2 


M 


TV 


2 


MS Power 


MS Power IE 3.11 


M 


TV 


2 


Measurement Report 


Measurement Report IE 3.12 


O 


TLV 


18 



2.2.5 Reject 

The Reject is a message from the BSS to the SMLC. It is a possible response to TOA Request, TA Request or MS 
Position Command and contains the following information elements. 

Table 2.5: Reject message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Cause 


Cause IE 3.14 


M 


TV 


2 



The following are the expected cause values for Reject message: 
congestion; 

channel Mode not supported; 
positioning procedure not supported; 
failure for other radio related events; 
incorrect serving cell identity. 

2.2.6 Reset 

The Reset is a message from the BSS to the SMLC. It is sent when the Response message contents for a positioning 
request are invalidated (e.g. due to handover) before the positioning procedure was completed. The message may also 
be sent instead of a Reject when a TOA Request cannot be performed due to an error in the serving cell identity. 

Table 2.6: Reset message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Cell ID 


Cell Identity IE 3.4 


M 


TV 


3 


Timing Advance 


Timing Advance IE 3.2 


M 


TV 


2 


Channel description 


Channel Description IE 3.8 


M 


TV 


4 


Cause 


Cause IE 3.1 


M 


TV 


2 


Measurement Report 


Measurement Report IE 3.12 


O 


TLV 


18 
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The following are the expected cause values for Reset message: 

- intra-BSS handover; 

failure for other radio related events; 
supervision Timer Expired; 

- incorrect serving cell identity. 

2.2.7 Abort 

The Abort is a message either from the BSS to the SMLC or SMLC to the BSS. Upon receiving this signal, either 
SMLC or BSS shall abort ongoing positioning procedure. 

Table 2.7: Abort message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Cause 


Cause IE 3.14 


M 


TV 


2 



The following are the expected cause values for Abort message: 
failure for other radio related events; 
supervision Timer Expired; 
- inter BSS handover; 

loss of signalling connection to MS. 

2.2.8 TA Layer3 

The TA Layer3 is an optional encapsulated message from the BSS to the SMLC that adds the following information in 
Complete layer 3 Information as described in 3GPP TS 08.08. 

Table 2.8: TA Layer3 message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


Timing Advance 


Timing Advance IE 3.2 


M 


TV 


2 


Measurement Report 


Measurement Report IE 3.12 


O 


TLV 


18 



2.2.9 MS Position Command 

The BSSLAP MS Position Command is a message from the SMLC to BSS that contains the following information 
elements. 

Table 2.9: MS Position Command message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


flag 


RRLP flag IE 3.15 


M 


TV 


2 


RRLP Info 


RRLP IE 3.16 


M 


TLV 


3toN 
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2.2.10 MS Position Response 

The BSSLAP MS Position Response is a message from the BSS to the SMLC that contains the following information 
elements. 

Table 2.10: MS Position Response message content 



Information element 


Type/Reference 


Presence 


Format 


Length 


Message Type 


Message Type IE 3.1 


M 


V 


1 


flag 


RRLP flag IE 3.15 


M 


TV 


2 


RRLP Info 


RRLP IE 3.16 


M 


TLV 


3toN 


Timing Advance 


Timing Advance IE 3.2 


O 


TV 


2 


Measurement Report 


Measurement Report IE 3.12 


O 


TLV 


18 



3 Information element encodings 

This paragraph contains the coding of the signalling elements used. 

The following conventions are assumed for the sequence of transmission of bits and bytes: 

each bit position is marked as 1 to 8. Bit 1 is the least significant bit and is transmitted first; 

in an element octets are identified by number, octet 1 is transmitted first, then octet 2 etc. 

When a field extends over more than one octet, the order of bit values progressively decreases as the octet number 
increases. The least significant bit of the field is represented by the lowest numbered bit of the highest numbered octet 
of the field. 

For variable length elements a length indicator is included, this indicates the number of octets following in the 
element. 

All fields within Information Elements are mandatory unless otherwise specified. The Information Element 
Identifier shall always be included. 

All spare bits are set to 0. 

The elements used and their coding are: 



Element 






Identifier 


Element name 


Reference 


Coding 






0000 0001 


Timing Advance 


3.2 


0000 1000 


Handover Type 


3.3 


0000 1001 


Cell Identity 


3.4 


0000 1010 


Starting Time 


3.5 


0000 1011 


Neighbor Cell Identity 


3.6 


0000 1100 


Neighbor Starting Time 


3.7 


0001 0000 


Channel Description 


3.8 


0001 0001 


Frequency List 


3.9 


0001 0010 


Handover Reference 


3.10 


0001 0011 


MS Power 


3.11 


0001 0100 


Measurement Report 


3.12 


0001 0101 


Delta Timer 


3.13 


0001 1000 


Cause 


3.14 


0001 1001 


RRLP Flag 


3.15 


0001 1011 


RRLP IE 


3.16 



All unassigned codes are spare. 
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3.1 Message Type IE 

Message Type uniquely identifies the message being sent. It is a single octet element, mandatory in all messages. 
All unassigned codes are spare. 



87654321 



000 
000 
000 
000 
000 
000 
000 
000 
000 
000 
000 



00000 
0000 1 
00010 
00100 
00101 
010 10 
01011 
01100 
01101 
01111 
10000 



Reserved. 

TA REQUEST 

TA RESPONSE 

TOA REQUEST 

TOA RESPONSE 

REJECT 

RESET 

ABORT 

TA LAYER3 

MS Position Command 

MS Position Response 



3.2 Timing Advance IE 

This element contains the Timing Advance measured by the BTS. 



Element identifier 
Timing Advance 



octet 1 
octet 2 



The coding of the timing advance value field is the binary representation of the timing advance in bit periods; 1 bit 
period = 48/13 us, as described in 3GPP TS 04.08 with the difference that all 8 bits are significant (instead of the 
normal 6 bits), which is necessary in order to report TA from extended range cells. To be correct, values over 63 do not 
correspond to a TA used by the MS (maximum is 63). Instead values over 63 correspond to the access delay measured 
by the BTS. 



3.3 Handover Type IE 

This IE defines the preferred type of handover for positioning. 



8|7l6|5j4 3 | 2 | 1 | 


Element identifier octet 1 


Handover Type octet 2 



The coding of the handover type field is as follows: 

0000 0000 Intra-cell handover to same channel; 
0000 0001 Intra-cell handover to new channel; 

- 0000 0010 Inter-cell handover; 

- 0000 001 1 BSS selects handover type; 
all other values reserved. 
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3.4 Cell Identity IE 

This element defines the cell identity of the MS serving cell. 



8|7|6|5|4|3|2|1 


Element identifier octet 1 


Cell Identity | octet 2-3 



The coding of the Cell Identity field is as defined in 3GPP TS 04.08 clause 10.5.1.1 Cell Identity (excluding IEI). 



3.5 Starting Time IE 

This element defines the starting frame number for handover. 



8 


7 


6 


1 5 | 4 | 


3 


2 | 1 




Element identifier 


octet 1 


Starting Time 


octet 2-3 



The coding of the Starting Time field is as defined in 3GPP TS 04.08 clause 10.5.2.38 Starting Time (excluding IEI). 

3.6 Neighbor Cell Identity IE 

This element defines the cell identity of the candidate neighbor cells for positioning handover. 



8 


7 


6 


I 5 | 4 


3 


2 | 1 




Element identifier 


octet 1 


Length 


octet 2 


Cell Identity (1) 


octets 3-4 






Cell Identity (n) 


octets 2n+1 - 2n+2 



The coding of the Cell Identity field is as defined in in 3GPP TS 04.08 subclause 10.5.1.1 Cell Identity (excluding 
IEI's). 

3.7 Neighbor Starting Time IE 

This element defines the starting frame number for handover to neighboring cells. 



8 1 7 


I 6 | 5 | 4 | 


3 | 2 | 1 




Element identifier 


octet 1 


Length 


octet 2 


Starting Time (1) 


octets 3-4 






Starting Time (n) 


octets 2n+1 - 2n+2 



The coding of the Starting Time field is as defined in 3GPP TS 04.08 subclause 10.5.2.38 Starting Time (excluding 
IEI). 



3.8 Channel Decription IE 

This element defines the physical channel allocation of the MS. 



8 


7 


6 | 5 | 4 | 3 


2 | 1 




Element identifier 


octet 1 


Channel Description 


octets 2-4 
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The coding of Channel Description field is as defined in 3GPP TS 04.08 subclause 10.5.2.5a Channel Description 
(excluding IEI). 

3.9 Frequency List IE 

The Frequency List IE contains a list of frequencies used by the MS. 



8 


7 


6 


1 5 | 4 | 


3 


2 


1 










Element identifier 








octet 1 








Length 








octet 2 








Frequency List 








octets 3-n 



The coding of Frequency List field is as defined in 3GPP TS 04.08 subclause 10.5.2.13 Frequency List (excluding IEI 
and length field). 

3.10 Handover Reference IE 

This element defines the handover reference number used by the MS. 



8 


7 


6 | 5 | 4 | 3 


2 | 1 




Element identifier 


octet 1 


Handover Reference 


octet 2 



The coding of Handover Reference field is as defined in 3GPP TS 04.08 subclause 10.5.2.15 Handover Reference 
(excluding IEI). 



3.11 MS Power IE 

This element contains the MS power. 



Element identifier 
MS Power 



octet 1 
octet 2 



The MS Power field is encoded as in 3GPP TS 04.08 subclause 10.5.2.28 Power Command (excluding IEI) and 
3GPP TS 05.08. 



3.12 Measurement Report IE 

This element contains the measurement report from the BSS. 



8 


7 


6 | 5 | 4 | 3 


2 | 1 




Element identifier 


octet 1 


Length 


octet 2 


Measurement Results 


octet 3-1 8 



The Measurement Results field is encoded as in 3GPP TS 04.08 subclause 10.5.2.20 Measurement Result (excluding 
IEI). 
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3.13 Delta Timer 

This element contains the value of the delta timer. The coding is as follows. 



8 


7 


6 


I 5 | 4 


3 


2 


1 










Element identifier 








octet 1 








Timer Value 








octet 2 



The Timer Value field is expressed in units of 0,05s. 



3.14 Cause IE 



This element contains the cause value. 



8 


7 


6 


I 5 | 4 | 


3 


2 I 1 




Element identifier 


octet 1 


Cause value 


octet 2 



The cause field is coded as follows: 



0000 0000 


Congestion 


0000 0001 


Channel Mode not supported 


0000 0010 


Positioning procedure not supported 


0000 001 1 


Failure for other radio related events 


0000 0100 


Intra-BSS handover 


0000 0101 


Supervision Timer Expired 


0000 0110 


Inter-BSS handover 


0000 0111 


Loss of signalling connection to MS 


0000 1000 


Incorrect serving cell identity 


All unassigned codes are spare. 



3.15 RRLPFIaglE 



This element is coded as: 



8 


7 


6 | 5 | 4 | 


3 


2 


| 1 




Element identifier 


octet 1 






SPARE 






I Flagl 


octet 2 



The fields are coded as follows: 
Flag 1 (Octet 2, bit 1) 

- Position Command (SMLC to BSC) or final response (BSC to SMLC) 

1 - Not a Positioning Command or final response 

3.16 RRLPIE 

RRLP IE is coded as: 



8 


7 


I 6 | 5 | 4 | 3 | 


2 I 1 




Element identifier 


octet 1 


Length 


octet 2-3 


RRLP APDU (3GPP TS 04.31) 


octet 4-N 
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